Mismatched apparmor features on HWE kernel roll

[John Chittum]

In Ubuntu 22.04, the HWE kernel has rolled to 5.19. the 5.19 kernel includes the apparmor feature for ipc/posix_mqueue. livecd-rootfs only contains features for the 5.15 kernel, thus missing ipc/posix_mqueue. This leads to snap_preseed having a mismatch in features, and the preseed is not optimized. in a cloud environment this can lead to boot delays of between 5 and 10s (rough measurements observed while debugging)

livecd-rootfs bind mounts apparmor features in functions/setup_mountpoint. This occurs early in the process when the final kernel is unknown. This only affects 22.04 at this time, but a fix, when committed, should also be in the main branch, to ensure future compatibility

TESTING

a failing system will present issues when checking `snap debug seeding`

example bad output:

'preseed-system-key': {'apparmor-features': ['caps', 'dbus', 'domain', 'file',
                                           'mount', 'namespaces', 'network',
                                           'network_v8', 'policy', 'ptrace',
                                           'query', 'rlimit', 'signal'],
                     'apparmor-parser-features': ['cap-audit-read',
                                                  'cap-bpf', 'mqueue',
                                                  'qipcrtr-socket', 'unsafe',
                                                  'xdp'],
                     'apparmor-parser-mtime': 1666191120,
                     'build-id': '79b62e11a4cf60b38c3e2449d220a6078db42607',
                     'cgroup-version': '2',
                     'nfs-home': False,
                     'overlay-root': '',
                     'seccomp-compiler-version': 'd9242946c125eab1ac4e30a3a7f48ee885551585 '
                                                 '2.5.4 '
                                                 'c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d '
                                                 'bpf-actlog',
                     'seccomp-features': ['allow', 'errno', 'kill_process',
                                          'kill_thread', 'log', 'trace',
                                          'trap', 'user_notif'],
                     'version': 10},
'preseeded': True,
'seed-completion': '5.765s',
'seed-restart-system-key': {'apparmor-features': ['caps', 'dbus', 'domain',
                                                'file', 'ipc', 'mount',
                                                'namespaces', 'network',
                                                'network_v8', 'policy',
                                                'ptrace', 'query', 'rlimit',
                                                'signal'],
                          'apparmor-parser-features': ['cap-audit-read',
                                                       'cap-bpf', 'mqueue',
                                                       'qipcrtr-socket',
                                                       'unsafe', 'xdp'],
                          'apparmor-parser-mtime': 1666191120,
                          'build-id': '79b62e11a4cf60b38c3e2449d220a6078db42607',
                          'cgroup-version': '2',
                          'nfs-home': False,
                          'overlay-root': '',
                          'seccomp-compiler-version': 'd9242946c125eab1ac4e30a3a7f48ee885551585 '
                                                      '2.5.4 '
                                                      'c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d '
                                                      'bpf-actlog',
                          'seccomp-features': ['allow', 'errno',
                                               'kill_process', 'kill_thread',
                                               'log', 'trace', 'trap',
                                               'user_notif'],
                          'version': 10},
'seeded': True}

This shows the comparison between what was seeded ('preseed-system-key' and the running system 'seed-restart-system-key')

a passing test will only have times:

{'image-preseeding': '9.238s',
 'preseeded': True,
 'seed-completion': '9.726s',
 'seeded': True}

to test:

1. create an image with an HWE kernel (for CPC this is ec2, gce, azure, oracle)
2. register image in cloud
3. run an instance
4. check `snap debug seeding`

[John Chittum (jchittum)]

MP:

https://code.launchpad.net/~jchittum/livecd-rootfs/+git/livecd-rootfs/+merge/440607

[Łukasz Zemczak (sil2100)]

Hello John, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.765.23 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted livecd-rootfs (2.765.23) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

livecd-rootfs/2.765.23 (arm64, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#livecd-rootfs

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Thomas Bechtold (toabctl)]

follow-up bug to this: https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639

[Łukasz Zemczak (sil2100)]

Hello John, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.765.24 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[John Chittum (jchittum)]

This fix, and accompanying MP was merged quite a while ago. Not sure how it hit SRU again, other than me failing to set it to verified and fixed in livecd-rootfs

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for livecd-rootfs has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.